Scammers have discovered a way to exploit an internal Microsoft email account to send spam and phishing emails that appear to come from legitimate Microsoft addresses used for account notifications.